1. Field of the Invention
The present invention relates to a method and apparatus for authenticating a password of a user terminal, and more particularly, to a password authentication technique for preventing a password from being exposed via shoulder surfing.
2. Description of the Related Art
A system including user information should only allow an access of a permitted user, and a technology for determining whether an access is attempted by a permitted lawful user is called a user authentication technique. Such a user authentication technique is widely used for security, in login of an Internet website, Internet banking, and a user terminal. Also, according to growing supplies of user terminals, such as laptops, smart phones, and tablet PCs, authentication processes using such user terminals are frequently performed in public places.
However, a conventional user authentication technique using a personal identification number (PIN) input may be weak against a shoulder surfing or recording attack by a third person and a spyware/keylogger attack because a password of a user is exposed as it is during an input process. Accordingly, a method of preventing a keylogger attack by randomly arranging numbers for a password has been suggested, but the password may still be exposed via a shoulder surfing or a recording attack.
Accordingly, the inventors of the present invention studied a user authentication interface technique wherein a password is not exposed to a third person just by observing information input through a user authentication interface of a user terminal. A background technique of the present invention is disclosed in KR 10-2008-0011363 (published on 4 Feburary 2008).